|
PIN security - vulnerability by design |
|
ATM vendors pay increasing attention to anti-fraud technologies, focusing on the clear and simple idea of preventing criminals from stealing identity. NCR with it's Fraudulent Device Inhibitor is a bright example. Fundamental mistake of modern payment systems design is an idea to transfer plain identity information into ATM. Mag stripe, PIN, biometrics - all this identification methods rely on repeated transfer of constant data.
Alternative is obvious, simple and already used in practice. Rationale is to not transform identifying information into ATM. First candidate for implementing this approach is Personal Identification Number. Authenticity of cardholder can be verified by either challenge-response probe or multifactor authentication. Мultifactor authentication can give any person a kind of private encrypting pinpad. Though this solution may require only a software upgrade at the ATM host, vendors tend to promote technologies, involving multibillion network-wide hardware upgrades.
|